ropshell> use 2baf5bfad99c4c4431432c9df390c739 (download)
name         : ntkrnlpa.exe (i386/PE)
base address : 0x401000
total gadgets: 8015

ropshell> suggest "jmp"
> 0x00450b3d : push esp; ret
> 0x004032fb : jmp eax
> 0x004022bb : jmp ebx
> 0x0040320b : jmp ecx
> 0x0040392b : jmp edx
> 0x0040339b : jmp esi
> 0x00405547 : jmp edi
> 0x004064b3 : jmp ebp
> 0x0040254b : jmp esp
> 0x00402c67 : jmp [eax]
> 0x0040264f : jmp [ebx]
> 0x004022e3 : jmp [ecx]
> 0x0040119f : jmp [edx]
> 0x00401333 : jmp [esi]
> 0x00403037 : jmp [edi]
> 0x004034ab : jmp [ebp + 0x2d]